<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en"><head><title>Implementer Draft: Fellowship One REST API Auth Core v1.0 (Draft)</title>
<meta http-equiv="Expires" content="Wed, 01 Jul 2009 09:15:07 +0000">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="description" content="Fellowship One REST API Auth Core v1.0 (Draft)">
<meta name="generator" content="xml2rfc v1.33 (http://xml.resource.org/)">
<style type='text/css'><!--
        body {
                font-family: verdana, charcoal, helvetica, arial, sans-serif;
                font-size: small; color: #000; background-color: #FFF;
                margin: 2em;
        }
        h1, h2, h3, h4, h5, h6 {
                font-family: helvetica, monaco, "MS Sans Serif", arial, sans-serif;
                font-weight: bold; font-style: normal;
        }
        h1 { color: #900; background-color: transparent; text-align: right; }
        h3 { color: #333; background-color: transparent; }

        td.RFCbug {
                font-size: x-small; text-decoration: none;
                width: 30px; height: 30px; padding-top: 2px;
                text-align: justify; vertical-align: middle;
                background-color: #000;
        }
        td.RFCbug span.RFC {
                font-family: monaco, charcoal, geneva, "MS Sans Serif", helvetica, verdana, sans-serif;
                font-weight: bold; color: #666;
        }
        td.RFCbug span.hotText {
                font-family: charcoal, monaco, geneva, "MS Sans Serif", helvetica, verdana, sans-serif;
                font-weight: normal; text-align: center; color: #FFF;
        }

        table.TOCbug { width: 30px; height: 15px; }
        td.TOCbug {
                text-align: center; width: 30px; height: 15px;
                color: #FFF; background-color: #900;
        }
        td.TOCbug a {
                font-family: monaco, charcoal, geneva, "MS Sans Serif", helvetica, sans-serif;
                font-weight: bold; font-size: x-small; text-decoration: none;
                color: #FFF; background-color: transparent;
        }

        td.header {
                font-family: arial, helvetica, sans-serif; font-size: x-small;
                vertical-align: top; width: 33%;
                color: #FFF; background-color: #666;
        }
        td.author { font-weight: bold; font-size: x-small; margin-left: 4em; }
        td.author-text { font-size: x-small; }

        /* info code from SantaKlauss at http://www.madaboutstyle.com/tooltip2.html */
        a.info {
                /* This is the key. */
                position: relative;
                z-index: 24;
                text-decoration: none;
        }
        a.info:hover {
                z-index: 25;
                color: #FFF; background-color: #900;
        }
        a.info span { display: none; }
        a.info:hover span.info {
                /* The span will display just on :hover state. */
                display: block;
                position: absolute;
                font-size: smaller;
                top: 2em; left: -5em; width: 15em;
                padding: 2px; border: 1px solid #333;
                color: #900; background-color: #EEE;
                text-align: left;
        }

        a { font-weight: bold; }
        a:link    { color: #900; background-color: transparent; }
        a:visited { color: #633; background-color: transparent; }
        a:active  { color: #633; background-color: transparent; }

        p { margin-left: 2em; margin-right: 2em; }
        p.copyright { font-size: x-small; }
        p.toc { font-size: small; font-weight: bold; margin-left: 3em; }
        table.toc { margin: 0 0 0 3em; padding: 0; border: 0; vertical-align: text-top; }
        td.toc { font-size: small; font-weight: bold; vertical-align: text-top; }

        ol.text { margin-left: 2em; margin-right: 2em; }
        ul.text { margin-left: 2em; margin-right: 2em; }
        li      { margin-left: 3em; }

        /* RFC-2629 <spanx>s and <artwork>s. */
        em     { font-style: italic; }
        strong { font-weight: bold; }
        dfn    { font-weight: bold; font-style: normal; }
        cite   { font-weight: normal; font-style: normal; }
        tt     { color: #036; }
        tt, pre, pre dfn, pre em, pre cite, pre span {
                font-family: "Courier New", Courier, monospace; font-size: small;
        }
        pre {
                text-align: left; padding: 4px;
                color: #000; background-color: #CCC;
        }
        pre dfn  { color: #900; }
        pre em   { color: #66F; background-color: #FFC; font-weight: normal; }
        pre .key { color: #33C; font-weight: bold; }
        pre .id  { color: #900; }
        pre .str { color: #000; background-color: #CFF; }
        pre .val { color: #066; }
        pre .rep { color: #909; }
        pre .oth { color: #000; background-color: #FCF; }
        pre .err { background-color: #FCC; }

        /* RFC-2629 <texttable>s. */
        table.all, table.full, table.headers, table.none {
                font-size: small; text-align: center; border-width: 2px;
                vertical-align: top; border-collapse: collapse;
        }
        table.all, table.full { border-style: solid; border-color: black; }
        table.headers, table.none { border-style: none; }
        th {
                font-weight: bold; border-color: black;
                border-width: 2px 2px 3px 2px;
        }
        table.all th, table.full th { border-style: solid; }
        table.headers th { border-style: none none solid none; }
        table.none th { border-style: none; }
        table.all td {
                border-style: solid; border-color: #333;
                border-width: 1px 2px;
        }
        table.full td, table.headers td, table.none td { border-style: none; }

        hr { height: 1px; }
        hr.insert {
                width: 80%; border-style: none; border-width: 0;
                color: #CCC; background-color: #CCC;
        }
--></style>
</head>
<body>
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<table summary="layout" width="66%" border="0" cellpadding="0" cellspacing="0"><tr><td><table summary="layout" width="100%" border="0" cellpadding="2" cellspacing="1">
<tr><td class="header">Implementer Draft</td><td class="header">naf. Fellowship One OAuth</td></tr>
<tr><td class="header">&nbsp;</td><td class="header">Extension</td></tr>
<tr><td class="header">&nbsp;</td><td class="header">June 2009</td></tr>
</table></td></tr></table>
<h1><br />Fellowship One REST API Auth Core v1.0 (Draft)</h1>

<h3>Abstract</h3>

<p>
			This Authentication protocol is an extension of the OAuth 1.0 protocol which enables websites or applications (Consumers) 
			to access Protected Resources from a web service (Service Provider) via an API, without requiring Users to disclose their 
			Service Provider credentials to the Consumers. More generally, OAuth creates a freely-implementable and generic 
			methodology for API authentication.
		  
</p>
<p>
				This extension’s intent is to provide a pattern that will support the usage concepts of Trusted Consumer applications, 
				Multi-Tenant / multi-Users with multi-personas.  As well as provide a token based trust for consumer applications that 
				have a preexisting trust established (i.e. the consumer is a tenant of the service provider and the consumer’s users have 
				established a trust with the service provide via the consumer). 
		  
</p>
<p>
			  This enables the usage of many security measures from the OAuth Protocol while allowing the applications written by those parties accept credentials directly.
			   Since the user already "trusts" the Consumer / Organization who wrote the application encoding and accepting credentials directly 
			   ensures seemless integration.
		  
</p><a name="toc"></a><br /><hr />
<h3>Table of Contents</h3>
<p class="toc">
<a href="#anchor1">1.</a>&nbsp;
Authors<br />
<a href="#anchor2">2.</a>&nbsp;
Notation and Conventions<br />
<a href="#anchor3">3.</a>&nbsp;
Definitions<br />
<a href="#anchor4">4.</a>&nbsp;
Multi-Tenant Configuration<br />
&nbsp;&nbsp;&nbsp;&nbsp;<a href="#config_steps">4.1.</a>&nbsp;
Steps<br />
&nbsp;&nbsp;&nbsp;&nbsp;<a href="#oauth_urls">4.2.</a>&nbsp;
URLs<br />
<a href="#anchor7">5.</a>&nbsp;
Authentication Workflow<br />
&nbsp;&nbsp;&nbsp;&nbsp;<a href="#anchor8">5.1.</a>&nbsp;
Trusted credential based authentication (2nd Party)<br />
&nbsp;&nbsp;&nbsp;&nbsp;<a href="#anchor9">5.2.</a>&nbsp;
OAuth based authentication (3rd Party)<br />
<a href="#http_codes">6.</a>&nbsp;
*HTTP Response Codes<br />
<a href="#rfc.references1">7.</a>&nbsp;
References<br />
<a href="#rfc.authors">&#167;</a>&nbsp;
Author's Address<br />
</p>
<br clear="all" />

<a name="anchor1"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.1"></a><h3>1.&nbsp;
Authors</h3>

<p>
				</p>
<blockquote class="text">
<p>Jas Singh (jsingh@fellowshiptech.com)
</p>
<p>Kingsley Allen (kallen@fellowshiptech.com)
</p>
<p>Matt Vasquez (mvasquez@fellowshiptech.com)
</p>
<p>Nick Floyd (nfloyd@fellowshiptech.com), Editor
</p>
<p>Tim Hardy (thardy@fellowshiptech.com)
</p>
</blockquote><p>
			
</p>
<a name="anchor2"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.2"></a><h3>2.&nbsp;
Notation and Conventions</h3>

<p>
        The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
        "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
        document are to be interpreted as described in <a class='info' href='#RFC2119'>[RFC2119]<span> (</span><span class='info'>Bradner, B., &ldquo;Key words for use in RFCs to Indicate Requirement Levels,&rdquo; .</span><span>)</span></a>.
        Domain name examples use <a class='info' href='#RFC2606'>[RFC2606]<span> (</span><span class='info'>Eastlake, D. and A. Panitz, &ldquo;Reserved Top Level DNS Names,&rdquo; .</span><span>)</span></a>.
      
</p>
<p>
		  OAuth Core 1.0 references and definitions can be viewed : http://oauth.net/core/1.0/
      
</p>
<a name="anchor3"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.3"></a><h3>3.&nbsp;
Definitions</h3>

<p>
				</p>
<blockquote class="text"><dl>
<dt>1st Party Consumer Applications:</dt>
<dd>
							Applications written and made public by the Service Provider (Fellowship Technologies) – They will be marked as Public and as Trusted by the Service Provider.
						
</dd>
<dt>2nd Party User Trusted Consumer Applications:</dt>
<dd>
						applications written and made private by the Consumer and used by the Consumer’s(or Tenant’s) Users – They will be marked as Private by the Service Provider.
					  
</dd>
<dt>3rd Party Consumer Applications:</dt>
<dd>
						Defined as applications written and made public for consumption across Tenants – They will be marked as Public by the Service Provider.
					  
</dd>
<dt>*Service Provider:</dt>
<dd>
						A web application that allows access via OAuth.
					  
</dd>
<dt>Tenant:</dt>
<dd>
						An entity / organization that encapsulates a group of Users with in the context of the Service Provider.
					  
</dd>
<dt>User:</dt>
<dd>
					   A persona of the User for the given Consumer Application implementation - An individual who has an account with the Service Provider.
					  
</dd>
<dt>User Type:</dt>
<dd>
					   A persona of the User for the given Consumer Application implementation - Based on personas established by the Service Provider.
					  
</dd>
<dt>Consumer:</dt>
<dd>
						3rd party / Tenant - A website or application that uses OAuth to access the Service Provider on behalf of the User. 
					  
</dd>
<dt>Trusted Consumer:</dt>
<dd>
						A Consumer where the User has implicit trust because the Consumer is both a Tenant / User of the Service Provider and the User's organization. 
					  
</dd>
<dt>*Protected Resource(s):</dt>
<dd>
						Data controlled by the Service Provider, which the Consumer can
						access through authentication.
					  
</dd>
<dt>*Consumer Developer:</dt>
<dd>
						An individual or organization that implements a Consumer.
					  
</dd>
<dt>*Consumer Key:</dt>
<dd>
						A value used by the Consumer to identify itself to the Service
						Provider.
					  
</dd>
<dt>*Consumer Secret:</dt>
<dd>
						A secret used by the Consumer to establish ownership of the
						Consumer Key.
					  
</dd>
<dt>*Request Token:</dt>
<dd>
						A value used by the Consumer to obtain authorization from the User,
						and exchanged for an Access Token.
					  
</dd>
<dt>*Access Token:</dt>
<dd>
						A value used by the Consumer to gain access to the Protected
						Resources on behalf of the User, instead of using the User's
						Service Provider credentials.
					  
</dd>
<dt>*Token Secret:</dt>
<dd>
						A secret used by the Consumer to establish ownership of a given
						Token.
					  
</dd>
</dl></blockquote><p>
			
</p>
<p>* from <a class='info' href='#OAuth'>[OAuth]<span> (</span><span class='info'>Atwood, M., Conlan, R., Cook, B., Culver, L., McCrea, K., Halff, L., Hammer, E., Laurie, B., Messina, C., Panzer, J., Quigley, S., Recordon, D., Sandler, E., Sergent, J., Sieling, T., Slesinsky, B., and A. Smith, &ldquo;OAuth,&rdquo; .</span><span>)</span></a> Core 1.0 Spec
</p>
<a name="anchor4"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.4"></a><h3>4.&nbsp;
Multi-Tenant Configuration</h3>

<p>
			  Tenants of the Service Provider must establish the trust through a series of configurations so that the 
			  Consumer / Tenant and its Users will be able to use this authentication extension.
		  
</p>
<a name="config_steps"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.4.1"></a><h3>4.1.&nbsp;
Steps</h3>

<p>
					</p>
<blockquote class="text"><dl>
<dt>Step 1:</dt>
<dd>
							Before any Consumer applications can access any Tenant data the Tenant must first enable access to thier data via Service Providers interface.
						
</dd>
<dt>Step 2:</dt>
<dd>
							The Tenant must establish a relationship with and 1st, 2nd, or 3rd party applications via Service Providers interface that they want thier Users to be able to use.
						
</dd>
<dt>Step 3:</dt>
<dd>
							Users of the Tenant can create / view / delete relationships (Access Tokens) with all Consumer Applications that the Tenant has established a relationship with.
						
</dd>
</dl></blockquote><p>
				
</p>
<a name="oauth_urls"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.4.2"></a><h3>4.2.&nbsp;
URLs</h3>

<p>
				  The Service Provider will supply URLs for the Consumers to use for both normal OAuth implementations and "Trusted" instances.
				
</p>
<a name="anchor5"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.4.2.1"></a><h3>4.2.1.&nbsp;
OAuth URLs</h3>

<p>Request Token:
</p>
<p>	
					</p>
<blockquote class="text"><dl>
<dt></dt>
<dd>[GET] https://tenant.sp.com/v1/Tokens/RequestToken
</dd>
<dt></dt>
<dd>[POST] https://tenant.sp.com/v1/Tokens/RequestToken
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>Required header - Content-Length: 0
</dd>
</dl></blockquote>
</dd>
</dl></blockquote><p>
					
</p>
<p>User Authorization:
</p>
<p>
					</p>
<blockquote class="text"><dl>
<dt></dt>
<dd>Redirect User: https://tenant.sp.com/v1/[User Type]/Login
</dd>
</dl></blockquote><p>
					
</p>
<p>Access Token:
</p>
<p>	
					</p>
<blockquote class="text"><dl>
<dt></dt>
<dd>[GET] https://tenant.sp.com/v1/Tokens/AccessToken
</dd>
<dt></dt>
<dd>[POST] https://tenant.sp.com/v1/Tokens/AccessToken
</dd>
<dt></dt>
<dd>
							 
<blockquote class="text"><dl>
<dt></dt>
<dd> Required header - Content-Length: 0
</dd>
</dl></blockquote>
						
</dd>
</dl></blockquote><p>
					
</p>
<p>
						  It is RECOMMENDED that Consumer application use POST when requesting Tokens, however the Service Provider SHOULD support both GET and POST
					 
</p>
<a name="anchor6"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.4.2.2"></a><h3>4.2.2.&nbsp;
Trusted URLs</h3>

<p>Access Token:
</p>
<p>		
					</p>
<blockquote class="text"><dl>
<dt></dt>
<dd>[GET] https://tenant.sp.com/v1/[User Type]/AccessToken
</dd>
<dt></dt>
<dd>[POST] https://tenant.sp.com/v1/[User Type]/AccessToken
</dd>
<dt></dt>
<dd>
								 
<blockquote class="text"><dl>
<dt></dt>
<dd> Required header - Content-Length: 0
</dd>
</dl></blockquote>
							
</dd>
</dl></blockquote><p>
					
</p>
<p>
						  It is RECOMMENDED that Consumer application use POST when requesting Tokens, however the Service Provider SHOULD support both GET and POST
					 
</p>
<a name="anchor7"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.5"></a><h3>5.&nbsp;
Authentication Workflow</h3>

<a name="anchor8"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.5.1"></a><h3>5.1.&nbsp;
Trusted credential based authentication (2nd Party)</h3>

<p>
				</p>
<blockquote class="text"><dl>
<dt></dt>
<dd>Consumer Application collects the User's credentials directly
</dd>
<dt></dt>
<dd>Consumer Application concatenates the user name and password with a space 
				and base64 encodes the credentials
</dd>
<dt></dt>
<dd>Consumer Application puts the encoded credentials in the body of the request 
				(no parameter assignment, just put the bytes in the request)
</dd>
<dt></dt>
<dd>
					
<blockquote class="text"><dl>
<dt></dt>
<dd> If the consumer is using the accept header value: application/x-www-form-urlencoded then the 
					 consumer must pass the credentials using the following format
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ec=bXZhc3F1ZXogcGEkJHcwcmQ%3d</pre></div>
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>Credentials must be URL Encoded after they are base64 encoded
</dd>
</dl></blockquote>
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>Consumer Application posts credentials to the following URI depending on User Type:
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>This request is signed using <a class='info' href='#OAuth'>[OAuth]<span> (</span><span class='info'>Atwood, M., Conlan, R., Cook, B., Culver, L., McCrea, K., Halff, L., Hammer, E., Laurie, B., Messina, C., Panzer, J., Quigley, S., Recordon, D., Sandler, E., Sergent, J., Sieling, T., Slesinsky, B., and A. Smith, &ldquo;OAuth,&rdquo; .</span><span>)</span></a> signing
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>https://tenant.sp.com/v1/[User Type]/AccessToken</pre></div>
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>The Service Provider will hand the Consumer Application back an Access Token via:
</dd>
<dt></dt>
<dd>Response body:
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>This request is signed using <a class='info' href='#OAuth'>[OAuth]<span> (</span><span class='info'>Atwood, M., Conlan, R., Cook, B., Culver, L., McCrea, K., Halff, L., Hammer, E., Laurie, B., Messina, C., Panzer, J., Quigley, S., Recordon, D., Sandler, E., Sergent, J., Sieling, T., Slesinsky, B., and A. Smith, &ldquo;OAuth,&rdquo; .</span><span>)</span></a> signing
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. oauth_token=afd011d3-fbd3-4c69-8326-a24fad8d0c34&amp;oauth_token_secret=ab86c226-fc65-4d32-a33c-8b54a753655e</pre></div>
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>Header:
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. oauth_token=afd011d3-fbd3-4c69-8326-a24fad8d0c34</pre></div>
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>oauth_token_secret=ab86c226-fc65-4d32-a33c-8b54a753655e</pre></div>
</dd>
<dt></dt>
<dd>The Consumer Application will also get a URI to the User resource via Content-Location header:
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. Content-Location=https://tenant.sp.com/v1/People/123</pre></div>
</dd>
<dt></dt>
<dd>The Consumer Application will access the User's data using the Access Token and Token Secret
</dd>
</dl></blockquote><p>
				
</p>
<a name="anchor9"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.5.2"></a><h3>5.2.&nbsp;
OAuth based authentication (3rd Party)</h3>

<p></p>
<blockquote class="text"><dl>
<dt></dt>
<dd>Consumer Application requests an unauthenticated Request Token
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>This request is signed using <a class='info' href='#OAuth'>[OAuth]<span> (</span><span class='info'>Atwood, M., Conlan, R., Cook, B., Culver, L., McCrea, K., Halff, L., Hammer, E., Laurie, B., Messina, C., Panzer, J., Quigley, S., Recordon, D., Sandler, E., Sergent, J., Sieling, T., Slesinsky, B., and A. Smith, &ldquo;OAuth,&rdquo; .</span><span>)</span></a> signing 
</dd>
<dt></dt>
<dd>[GET] https://tenant.sp.com/v1/[User Type]/AccessToken
</dd>
<dt></dt>
<dd>[POST] https://tenant.sp.com/v1/[User Type]/AccessToken
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd> Required header - Content-Length: 0
</dd>
</dl></blockquote>
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>Service Provider passes back an unauthorized Request Token
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>Response body:
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. oauth_token=afd011d3-fbd3-4c69-8326-a24fad8d0c34&amp;oauth_token_secret=ab86c226-fc65-4d32-a33c-8b54a753655e</pre></div>
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>Consumer Application requests user authorization via redirect
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>This request is signed using <a class='info' href='#OAuth'>[OAuth]<span> (</span><span class='info'>Atwood, M., Conlan, R., Cook, B., Culver, L., McCrea, K., Halff, L., Hammer, E., Laurie, B., Messina, C., Panzer, J., Quigley, S., Recordon, D., Sandler, E., Sergent, J., Sieling, T., Slesinsky, B., and A. Smith, &ldquo;OAuth,&rdquo; .</span><span>)</span></a> signing
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>The Consumer Application will pass the Request Token via url
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. https://tenant.sp.com/v1/Tokens/RequestToken?oauth_token=afd011d3-fbd3-4c69-8326-a24fad8d0c34</pre></div>
</dd>
<dt></dt>
<dd>The Consumer Application may pass a callback url via url as an OPTIONAL parameter
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. https:///tenant.sp.com/v1/Tokens/RequestToken?oauth_token=afd011d3-fbd3-4c69-8326-a24fad8d0c34&amp;oauth_callback=http://www.myconsumerapp.com/home</pre></div>
</dd>
<dt></dt>
<dd>User URL: 
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. https:///tenant.sp.com/v1/[User Type]/Login</pre></div>
</dd>
</dl></blockquote>
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>The User enters thier credentials in using the Service Provider's interface
</dd>
<dt></dt>
<dd>The User will either Accept or Deny the request 
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>If the User allows access then the Service Provider authenticates the Request Token
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>If a oauth_callback parameter was provided the Service Provider sends the User back to the Consumer Application
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. Redirect http://www.myconsumerapp.com/home?oauthtoken=afd011d3-fbd3-4c69-8326-a24fad8d0c34</pre></div>
</dd>
<dt></dt>
<dd>If no oauth_callback parameter was provided the Service Provider sends the User to another page with the authorized Request Token witten in the body
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>If the User denies access then the Service Provider marks the Request Token as revoked
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>If a oauth_callback parameter was provided the Service Provider sends the User back to the Consumer Application <a class='info' href='#OAuthProblemReporting'>[OAuthProblemReporting]<span> (</span><span class='info'>Kristian, J., &ldquo;OAuth Problem Reporting Extension,&rdquo; .</span><span>)</span></a>
							
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. Redirect http://www.myconsumerapp.com/home?permissiondenied=The+user+has+denied+access+to+all+protected+resources.</pre></div>
</dd>
<dt></dt>
<dd>If no oauth_callback parameter was provided the Service Provider sends the User to another page stating that Request Token has been revoked
</dd>
</dl></blockquote>
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>The Consumer Application will take the Authorized Request Token and it's corresponding Token Secret and request an Access Token
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>This request is signed using <a class='info' href='#OAuth'>[OAuth]<span> (</span><span class='info'>Atwood, M., Conlan, R., Cook, B., Culver, L., McCrea, K., Halff, L., Hammer, E., Laurie, B., Messina, C., Panzer, J., Quigley, S., Recordon, D., Sandler, E., Sergent, J., Sieling, T., Slesinsky, B., and A. Smith, &ldquo;OAuth,&rdquo; .</span><span>)</span></a> signing
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>The Consumer Application will sign the request using the Authenticated Request Token and Token Secret
</dd>
<dt></dt>
<dd>The Consumer Application will pass the Authenticated Request Token via url
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>[GET] https://tenant.sp.com/v1/Tokens/AccessToken
</dd>
<dt></dt>
<dd>[POST] https://tenant.sp.com/v1/Tokens/AccessToken
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>Required header when using the [POST] verb - Content-Length: 0
</dd>
</dl></blockquote>
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>The Service Provider will hand the Consumer Application back an Access Token via:
</dd>
<dt></dt>
<dd>
<blockquote class="text"><dl>
<dt></dt>
<dd>Response body:
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. oauth_token=afd011d3-fbd3-4c69-8326-a24fad8d0c34&amp;oauth_token_secret=ab86c226-fc65-4d32-a33c-8b54a753655e</pre></div>
</dd>
<dt></dt>
<dd>Header:
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>oauth_token=afd011d3-fbd3-4c69-8326-a24fad8d0c34</pre></div>
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>oauth_token_secret=ab86c226-fc65-4d32-a33c-8b54a753655e</pre></div>
</dd>
</dl></blockquote>
</dd>
<dt></dt>
<dd>The Consumer Application will also get a URI to the User resource via Content-Location header:
</dd>
<dt></dt>
<dd><div style='display: table; width: 0; margin-left: 3em; margin-right: auto'><pre>ex. Content-Location=https://tenant.sp.com/v1/People/123</pre></div>
</dd>
<dt></dt>
<dd>The Consumer Application will access the User's data using the Access Token and Token Secret
</dd>
</dl></blockquote>

<a name="http_codes"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<a name="rfc.section.6"></a><h3>6.&nbsp;
*HTTP Response Codes</h3>

<p>
        This section applies only to the Request Token and Access Token
        requests. In general, the Service Provider SHOULD use the
        response codes defined in <a class='info' href='#RFC2616'>[RFC2616]<span> (</span><span class='info'>Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and T. Berners-Lee, &ldquo;Hypertext Transfer Protocol -- HTTP/1.1,&rdquo; .</span><span>)</span></a> Section 10. When
        the Service Provider rejects a Consumer request, it SHOULD respond with
        HTTP 400 Bad Request or HTTP 401 Unauthorized.
</p>
<p>
				</p>
<blockquote class="text"><dl>
<dt></dt>
<dd>HTTP 400 Bad Request
</dd>
<dt></dt>
<dd> 
							
<blockquote class="text"><dl>
<dt></dt>
<dd>
									Unsupported parameter
								
</dd>
<dt></dt>
<dd>
									Unsupported signature method
								
</dd>
<dt></dt>
<dd>
									Missing required parameter
								
</dd>
<dt></dt>
<dd>
									Duplicated OAuth Protocol Parameter
								
</dd>
</dl></blockquote>
						
</dd>
<dt></dt>
<dd>HTTP 401 Unauthorized
</dd>
<dt></dt>
<dd>
						
<ul class="text">
<li>
								Invalid Consumer Key
							
</li>
<li>
								Invalid / expired Token
							
</li>
<li>
								Invalid signature
							
</li>
<li>
								Invalid / used nonce
							
</li>
</ul>
					
</dd>
</dl></blockquote><p>
			
</p>
<p>
			*from <a class='info' href='#OAuth'>[OAuth]<span> (</span><span class='info'>Atwood, M., Conlan, R., Cook, B., Culver, L., McCrea, K., Halff, L., Hammer, E., Laurie, B., Messina, C., Panzer, J., Quigley, S., Recordon, D., Sandler, E., Sergent, J., Sieling, T., Slesinsky, B., and A. Smith, &ldquo;OAuth,&rdquo; .</span><span>)</span></a> Core 1.0 Spec 			
			
</p>
<a name="rfc.references1"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<h3>7.&nbsp;References</h3>
<table width="99%" border="0">
<tr><td class="author-text" valign="top"><a name="FellowshipOneRESTAPI">[FellowshipOneRESTAPI]</a></td>
<td class="author-text">Floyd, N., &ldquo;<a href="http://developer.fellowshipone.com">Fellowship One REST API</a>.&rdquo;</td></tr>
<tr><td class="author-text" valign="top"><a name="OAuth">[OAuth]</a></td>
<td class="author-text">Atwood, M., Conlan, R., Cook, B., Culver, L., McCrea, K., Halff, L., Hammer, E., Laurie, B., Messina, C., Panzer, J., Quigley, S., Recordon, D., Sandler, E., Sergent, J., Sieling, T., Slesinsky, B., and A. Smith, &ldquo;<a href="http://oauth.net/core/1.0">OAuth</a>.&rdquo;</td></tr>
<tr><td class="author-text" valign="top"><a name="OAuthProblemReporting">[OAuthProblemReporting]</a></td>
<td class="author-text">Kristian, J., &ldquo;<a href="http://oauth.pbworks.com/ProblemReporting">OAuth Problem Reporting Extension</a>.&rdquo;</td></tr>
<tr><td class="author-text" valign="top"><a name="RFC2119">[RFC2119]</a></td>
<td class="author-text">Bradner, B., &ldquo;<a href="http://tools.ietf.org/html/rfc2119">Key words for use in RFCs to Indicate Requirement Levels</a>,&rdquo; RFC&nbsp;2119.</td></tr>
<tr><td class="author-text" valign="top"><a name="RFC2606">[RFC2606]</a></td>
<td class="author-text">Eastlake, D. and A. Panitz, &ldquo;<a href="http://tools.ietf.org/html/rfc2606">Reserved Top Level DNS Names</a>,&rdquo; RFC&nbsp;2606.</td></tr>
<tr><td class="author-text" valign="top"><a name="RFC2616">[RFC2616]</a></td>
<td class="author-text">Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and T. Berners-Lee, &ldquo;<a href="http://tools.ietf.org/html/rfc2616">Hypertext Transfer Protocol -- HTTP/1.1</a>,&rdquo; RFC&nbsp;2616.</td></tr>
<tr><td class="author-text" valign="top"><a name="RFC2617">[RFC2617]</a></td>
<td class="author-text">Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., Leach, P., Luotonen, A., and L. Stewart, &ldquo;<a href="http://tools.ietf.org/html/rfc2617">HTTP Authentication: Basic and Digest Access Authentication</a>,&rdquo; RFC&nbsp;2617.</td></tr>
</table>

<a name="rfc.authors"></a><br /><hr />
<table summary="layout" cellpadding="0" cellspacing="2" class="TOCbug" align="right"><tr><td class="TOCbug"><a href="#toc">&nbsp;TOC&nbsp;</a></td></tr></table>
<h3>Author's Address</h3>
<table width="99%" border="0" cellpadding="0" cellspacing="0">
<tr><td class="author-text">&nbsp;</td>
<td class="author-text">Fellowship One API Group</td></tr>
<tr><td class="author" align="right">Email:&nbsp;</td>
<td class="author-text"><a href="mailto:api@fellowshipone.com">api@fellowshipone.com</a></td></tr>
</table>
</body></html>

